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Abstract — We investigate the secret key agreement from corre- 
lated vector Gaussian sources in which the legitimate parties can 
use the public communication with limited rate. For the class 
of protocols with the one-way public communication, we show 
that the optimal trade-off between the rate of key generation 
and the rate of the public communication is characterized as 
an optimization problem of a Gaussian random variable. The 
characterization is derived by using the enhancement technique 
introduced by Weingarten et. al. for MIMO Gaussian broadcast 
channel. 

Index Terms — Enhancement Technique, Entropy Power In- 
equality, Extremal Inequality, Key Agreement, Rate Limited 
Public Communication Privacy Amplification, Vector Gaussian 
Sources, 

I. Introduction 

Key agreement is one of the most important problems 
in the cryptography, and it has been extensively studied in 
the information theory for discrete sources (e.g. (TJ, (2), 
(3)) since the problem formulation by Maurer [4|. Recently, 
the confidential message transmission J5j, (6) in the MIMO 
wireless communication has attracted considerable attention 
as a practical problem setting (e.g. Q, E, HO), ifTTIl . 
Ifl2l . |[T3ll , Ifl4l . |fT31 ). Although the key agreement in the 
context of the wireless communication has also attracted 
considerable attention recently |fl6l , the key agreement from 
analog sources has not been studied sufficiently compared to 
the confidential message transmission. As a fundamental case 
of the key agreement from analog sources, we consider the 
key agreement from correlated vector Gaussian sources in this 
paper. More specifically, we consider the problem in which 
the legitimate parties, Alice and Bob, and an eavesdropper, 
Eve, have correlated vector Gaussian sources respectively, and 
Alice and Bob share a secret key from their sources by using 
the public communication. Recently, the key agreement from 
Gaussian sources has attracted considerable attention in the 
context of the quantum key distribution ifTTl . which is also a 
motivation to investigate the present problem. Fig.Q]illustrates 
a scenario we are considering. 

Typically, the first step of the key agreement protocol from 
analog sources is the quantization of the sources. In literatures 
(e.g. see 02), [18|, |19|), the authors used the scalar quantizer, 
i.e., the observed source is quantized in each time instant. 
Using the finer quantization, we can expect the higher key 
rate in the protocol, where the key rate is the ratio between the 
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Fig. 1, An example of the scenarios treated in this paper. The legitimate 
parties, Alice and Bob, and an eavesdropper, Eve, receive (vector) signals 
from the base station respectively. Alice and Bob generate a secret key from 
their received signals X and Y by using the public communication. 



length of the shared key and the block length of the sources 
that are used in the protocol. However, there is a problem 
such that the finer quantization might increase the rate of the 
public communication in the protocol. Although the public 
communication is usually regarded as a cheap resource in the 
context of the key agreement problem, it is limited by a certain 
amount in practice. Therefore, we consider the key agreement 
protocols with the rate limited public communication in this 
paper. The purpose of this paper is to clarify the trade-off 
between the key rate and the public communication rate of 
the key agreement protocol from vector Gaussian sources. 

The key agreement by rate limited public communication 
was first considered by Csiszai and Narayan for discrete 
sources 1121 . For the class of protocols with one-way pub- 
lic communication, they characterized the optimal trade-off 
between the key rate and the public communication rate in 
terms of the information theoretic quantities, i.e., they derived 
the so-called single letter characterization. However, there are 
two difficulties to extend their result to the vector Gaussian 
sources. 

First, the direct part of the proof in Q heavily relies on 
the finiteness of the alphabets of the sources, and cannot be 
applied to continuous sources. This difficulty was solved by 
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the authors in ||20ll , and this result will be also used in this 
paper. 

Second, although the converse part of Csiszar and Narayan's 
characterization can be easily extended to continuous sources, 
the characterization is not computable because the character- 
ization involves auxiliary random variables and the ranges of 
those random variables are unbounded for continuous sources. 

In ||20l for scalar Gaussian sources, the authors showed 
that Gaussian auxiliary random variables suffice, and derived a 
closed form expression of the optimal trade-off. In the problem 
for scalar Gaussian sources, we first solved the problem in 
which the sources are degraded, i.e., Alice's source, Bob's 
source, and Eve's source form a Markov chain in this order. 
Then, we reduced the general case to the degraded case by 
using the fact that scalar Gaussian correlated sources are 
stochastically degraded [21 1. 

In this paper for vector Gaussian sources, we show that 
Gaussian auxiliary random variables suffice, and characterize 
the optimal trade-off in terms of the (covariance) matrix 
optimization problem. One of difficulties to show our result is 
that vector Gaussian sources are not stochastically degraded 
in general, and cannot be reduced to the degraded case in the 
same manner as scalar Gaussian sources. To circumvent this 
difficulty, we utilize the enhancement technique introduced by 
Weingarten et al. 11221 . 

The rest of the paper is organized as follows: In Section ITT1 
we explain our problem formulation. In Section [ill] we show 
our main results and some numerical examples. In Sections 
HVl and [V] our main results are proved. Finally, in Section |VI] 
the conclusion and the future research agenda are discussed. 

II. Problem Formulation 

Let X, Y, and Z be correlated vector Gaussian sources on 
l m ", K m «, and R m = respectively, where R is the set of real 
numbers. Then, let X n , Y n , and Z n be i.i.d. copies of X, Y, 
and Z respectively. Throughout the paper, upper case letters 
indicate random variables, and the corresponding lower case 
letters indicate their realizations. We also use the following 
notations throughout the paper: E designates the covariance 
matrix of (X, Y, Z). E x , E XJ( , and Ej,u designate E[X T X], 
E[X T y], and the conditional covariance of Y given X etc.. 
N ~ 7V(0, A) means that the random variable N is a Gaussian 
vector with zero mean and covariance matrix A. We use \A\ 
to denote the determinant of the matrix A, | -g | to denote |gj, 
and we denote A ^ B ( A -< B) if the matrix B — A is positive 
semidefinite (definite). Throughout the paper, we assume that 
E >- 0. 

Although Alice and Bob can use public communication 
interactively in general, we concentrate on the class of key 
agreement protocols in which only Alice sends a message 
to Bob over the public channel. First, Alice computes the 
message C n from X n and sends the message to Bob over 
the public channel. Then, she also compute the key S n . Bob 
compute the key S' n from Y n and C n . Fig. [2] illustrates the 
protocol with one-way public communication. 

The error probability of the protocol is defined by 

e n := PY{S n ? S' n }. 



Alice Bob 
Public Channel 

o Hp \ o 

Eve 2j n 

Fig. 2. The key agreement protocol with one-way public communication. 
First, Alice sends the message C n to Bob over the public channel, which 
might be eavesdropped by Eve. Then, Alice compute the key S n and Bob 
compute the key S' n . The rate of the public communication is limited by R p . 

The security of the protocol is measured by the quantity 

v n : =log|5 n |- H(S n \C n ,Z n ), 

where S n is the range of the key S n . 

In this paper, we are interested in the trade-off between 
the public communication rate R p and the key rate Rk- The 
rate pair (R p , Rk) is defined to be achievable if there exists a 
sequence of protocols satisfying 

lim e„ = 0, 

n— >oo 

lim v n = 0, 

n— >oo 

lim sup — log | C n < Rp, 

n— >oo Tl 

liminf — log |iS„| > Rk, 

n— >oc TL 

where C n is the range of the message C n transmitted over the 
public channel. Then, the achievable rate region is defined as 

H(X,Y,Z) := {(R p ,R k ) : (R p , R k ) is achievable}. 

In ll20l . the authors showed a closed form expression of 
1Z(X, Y, Z) for the scalar problem, i.e., m x — rn y — m z = 1. 
In the next section, we show that the achievable rate region 
for the vector problem can be characterized as a (covariance) 
matrix optimization problem. 

III. Main Result 

A. Main Theorems 

In this section, we show our main results. Since the security 
quantities e n and v n only depend on the marginal distributions 
of (X, Y) and (X, Z) respectively, it suffice to consider 
(X, F, Z) of the form 

Y = BX + W y , 
Z = EX + W Z , 

where B E R m »x™ % E e M™;*™-, W y - M(0,I my ) and 
W z ~ Af(0,I mz )- In the rest of this paper, we omit the 
subscript of the identity matrix if the dimension is obvious 
from the context. 

One of the main results of this paper is the following. 
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Theorem 1 Let TZg (X, Y, Z) be the set of all rate pairs 
(R p , Rk) satisfying 

BE X B T + I 



> 



J x\u 



B^ X \ U B T 



I 



Rk < 



1 



log 



BT, X B T + 1 



B^x\uB T 



1 



■log 



EY> T E T + 1 



EZ x]u E T +I 



for some -< S x | u < £ x . Then, we have 

tz(x,y,z) = n G {x,Y,z). 

We are also interested in the asymptotic behavior of the 
function 



R k (R p ) := sup{R k : (R p ,R k ) e TZ(X,Y,Z)}. 



(1) 



Following the approach in ifTTl . we can obtain a closed 
form expression of lim/? p _ ! . 00 Rk(R p ) as follows. Let 4>i, i — 
1, . . . , m x be the generalized eigenvalues ||23l Chapter 6.3] of 
the matrices 



B BY* X + I m , SJ E EYjx + /„ 



Without loss of generality, we may assume that these gener- 
alized eigenvalues are ordered as 



> ■ ■ ■ > 



> 1 > 0p+i > 



> 



for some -< £ x u < £ x . Then, we have 

TZ(X,Y,Z)=Tl* G (X,Y,Z). 

Theorem|2]is shown in Section [TV] and Theorem[T]is shown 
in Section [Vl by using Theorem [2] 

B. Numerical Examples 

In this section, we show some numerical example to illus- 
trate Theorem Q] In general, calculation of lZc(X, Y, Z) in- 
volves a nonconvex optimization problem and is not tractable. 



However for m r > 2 and m,, 



1, following 



the method in 11241 (see also iflOlO , we can transform the 
calculation of TZq (X, Y, Z) into tractable form. 



For m x > 2 and m y 

Ip(^x\u) = \ log 



= m 2 
2j ... 



J x\u 



1, we have 

1 bX x b T + 1 
" 2 ° g bZ xlu bT + V 



where 6, e € 



1 . bZ x b T 
■log- 



1 



1 e'E x e T 
■log 



(2) we set 



1 



bX x]u b T + 1 



= 1 



e^ x \ u e - b^ x \ u b T + 1 
bZ xlu b T + 1 : 



1 



2 "° b^ x[u b T + 1 2 & e£ xN e T + l' 
Noting the relation 



i.e., a total of p of them are assumed to be greater than 1. 
Then, we have 



lim R k (R p ) 



max 

0-<E„i„-<E. 



log 



BYi x B T + 1 



BH x[u B T + I 
EY> X E T + 1 



2 ^ 

»=1 



log( 



(3) 



Since Eq. OJ can be proved almost in the same manner as 
IfTTl Theorem 3], we omit a proof. 

When m x = rn y = m z and both B and E are invertible, it 
suffice to consider the case in which 



Y = 
Z = 



X + Wy, 

x + w z , 



(4) 
(5) 



where the covariance matrices and £y^ are not neces- 
sarily identity but are invertible. Following 11221 . we call this 
case the aligned case. As is usual with the vector Gaussian 
problems (e.g. Il22l ). the general statement (Theorem [TJ is 
shown by detouring the statement for the aligned case. 

Theorem 2 Let K* G (X,Y,Z) be the set of all rate pairs 
(R p , R k ) satisfying 



> 



■= 2 log 

Rk < Ik(£>x[ 

'■= - log 
2 S 



T^log 



t = 



b^ x \ub 



b^ x \ u b 



bX x]u b T + 1 



Let 



Ip\^x\ui s ) 



5 log 



-'relit 



h{t) ■- 

Then we can easily find that 

K G (X,Y,Z) 

— {{Rp, Rk) ■ R P 



- - log(6£ x 6 T + 1) 

+ ilog(l + s), 
1 , bY> x b T + 1 1, , 

2 l0g ^TT + 2 l0g(1 + t) - 



c 1 1 



> 


Ip(E x \in s ): 


< 


h(t), 




Z-'x-i 


< 


e ^ X \u eT ~ 


< 


s}. 



b£<x\ub T , 









£*4 






" 2 


" 




f 5V„ 









2 



For fixed (s,t), the optimization problem 
minimize I p (£, x i u , s) 

subject to t(bT, x \ u b T + 1) < eE^^e 7 " - bY, x \ u b T 
b^ x \ u b T < s 
-< S x |„ ^ E x 

is a convex problem. By sweeping (s, t), we can calculate the 
region TZ G {X,Y,Z). 
For 



, b = [ 1 0.5 ] , e = [ 0.7 0.35 ] , (6) 
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0.25 



0.15 - 




IV. Proof of Theorem[2] 



0.05 - 



Fig. 3. "region" is Rk(R p ) defined in Eq. {T} for the sources given by 
Eq. {6). "upper bound" is the quantity I(X; Y) - I(X; Z). 




Fig. 4. "region" is Rk(R p ) defined in Eq. (T} for the sources given by 
Eq. 0. "upper bound is lim^ —> cc Rf ! (R p ) which is explicitly given by 
Eq. 



the region 1Zq(X, Y, Z) is plotted in Fig. [3] Note that this case 
is degraded in the sense of ll25l Definition 1], i.e., X o Y f-> 
Z by appropriately choosing the correlation between (Y,Z). 
In this case, the function Rk(R p ) converges to I(X;Y) — 
I(X; Z) as Rp increases. 
For 



2 
2 



b = [ 1 0.5 ] , e = [ 0.5 1 ] 



(7) 



the region H G (X,Y,Z) is plotted in Fig. 0] Note that 
(X, Y, Z) in this example is not degraded. Although I(X; Y)— 
I(X; Z) = in this example, Fig. [4] clarifies that appropriate 
quantization enables Alice and Bob to share a secret key at 
positive key rate. 

For non-degraded case, R/,(R p ) converges to the quantity 
given by Eq. (01 instead of I(X; Y)—I(X; Z) as R p increases, 
and it is also plotted in Fig. [4] 



A. Direct Part 



In J20J, the present authors proved the following proposi- 
tion, which is an extension of [2, Theorem 2.6] to continuous 
sources. 

Proposition 3 For an auxiliary random variable U satisfying 
the Markov chain 

U O X O (Y. Z). 

let (R p ,Rk) be a rate pair such that 

R p > I(U;X)-I(U;Y), 
Rk < I(U;Y)~I(U;Z). 

Then, we have (Rp, R k ) £ K(X, Y, Z). 

The direct part of Theorem [2] is shown by taking Gaussian 
auxiliary random variable U such that the conditional covari- 
ance matrix of X given U is S x i u in Proposition [3] □ 

B. Converse Part 

In the converse proof, we will use the following Proposition 
and Corollary. The proposition was shown for discrete sources 
in JU Theorem 2.6], and it can be shown almost in the same 
manner for continuous sources. 

Proposition 4 (|f2l) Suppose that a rate pair (R p ,Rk) is 
included in 1Z(X, Y, Z). Then, there exist auxiliary random 
variables U and V satisfying 



R k 



> I(U;X\Y), 

< I(U;Y\V)-I(U;Z\V), 



and the Markov chain 

Ffi[/oio(y,z). 



(8) 
(9) 



(10) 



For degraded sources, we can simplify the above proposition 
(see [20 Appendix B] for a proof). 

Corollary 5 Suppose that (X, Y, Z) is degraded, i.e., X o 
Y <->• Z. If (Rp, R k ) e U(X,Y,Z), then there exists an 



auxiliary random variable U satisfying 

Rp > I(U;X\Y)=I(U;X)-I(U;Y), 
Rk < I(U;Y\Z)=I(U;Y)-I(U;Z), 

and the Markov chain 

U o X o Y o Z. 



(11) 
(12) 



(13) 



We show a converse proof of Theorem |2] by contradiction. 
Suppose that there exists a rate pair such that G 
K(X,Y,Z) and (R°,R° k ) £ K* G (X,Y,Z), where we assume 
R1 > to avoid the trivial case. Then, there exists -< ^ 
Y, x such that ip(S°i ) < R°. Therefore, we can write 

6 (14) 



Rl 



Rl 
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for some S > 0, where Rt is given by the optimal value of for any (Rp, Rk) £ 1Z(X, Y, Z), where 



maximize 
subject to 



-< S-i,. ~4 S, 



An optimal solution E*| u of this optimization problem satisfies 
the Karash-Kuhn-Tucker (KKT) condition (see Appendix [A] 
for the derivation) 



( S x|u + E wJ 1 



M(E a 



.) 



(16) 
(17) 
(18) 



K^-JpCE^J) = 0, 
where p > and M >z 0. From Eqs. ( TPfl ) and ( fT8l . we have 

- = 4(E*,J - fiI P (K\J + S. (19) 

We shall find a contradiction to Eq. $1% by showing that for 

any (i? p ,i? fe ) e7e(X,r,Z) 



i2 fc -/J2p </*(£;■„) -M/ P (5^| J. 



(20) 



The proof of Eq. < f20b roughly consists of three steps: In the 
first step, we reduce the proof for the non-degraded sources 
to that for the degraded sources by using the enhancement 
technique introduced by Weingarten et. al. [22|. In the second 
step, we change the variable so that we can use the entropy 
power inequality (EPI). In the last step, we derive an upper 
bound on Rk — pR p by using the EPI, which turn out to be 
tight. 

Step 1: In this step, in order to reduce the proof for the 
non-degraded sources to that for the degraded sources, we 
introduce the covariance matrix E^ satisfying 

(i + m)(e;, +s 



Wy) 

= (i + mXe^ + EwJ^ + m. 

Then, we have (see Appendix [B] for a proof) 



-< ^ ^Wy 

E^ d Sw, 



(21) 



(22) 
(23) 



Let W y be the Gaussian random vector whose covariance 



matrix is E^ , and let 



Y = X + W v 



(24) 



From Eq. ( f23l . we can find that the sources (X, Y, Z) satisfy 
X ■<-> Y <-» Z. Furthermore, from Eq. ( f22b . we can also find 
that X <H- Y O Y, which implies 

K(X,Y,Z) C K{X,Y,Z). 

Thus, it suffice to show that Eq. (f20b holds for any (Rp, Rk) G 
1Z(X, Y, Z). In steps 2 and 3, we will show that 



Rk - vR P < h(K\u) - »ip(K\u) 



(25) 



log 



■log 



E K + E 



H'„ 



E x | u + E^ 



1 



h(^x\v) '■= 



Es + Ejy 



E x |u + E^ 



log 

2 B 



E, + E 



IV, 



E^i-i, + E^ 

Then, by using the relation (see Appendix [C] for a proof) 



(S^ + E^XE^ + E^)- 1 
= (S B + E w - y )(E;| u + E w -,)- 1 , (26) 

we have J fc (E*,J = 4(E*,J and i^J = J p (E*, ). 
Thus, Eq. ( |25l l implies that Eq. ( |20l i holds for any Rk) & 

K(X,Y,Z). 

Step 2: First, we show Eq. d25l > for p, = 0. In this case, 
from Eqs. ( fTol ) and ( l2Tb . we have E^ = E^- Thus, from 
Corollary [5] we have 

Rk - ■ i?p < /(17; y) - /(17; Z) = = / fe (E* |u ). 
Thus, we have the assertion. 



In order to prove Eq. (1251 1 for /i > 0, we change the variable 
as follows. Since (X, Y, Z) is jointly Gaussian, we can write 

X = K XZ Z + N X , 

Y = Ky X X + Ky Z Z + N 2 

for Gaussian random vectors Ni , N 2 with covariance matrices 

EjVi = E x |^ := E x — K xz z2 zx , 

Eat 2 — ^y\xz • — ^y Kyx^xy Kyz^->zyi 



where the coefficients are given by 



K xz — n xz zJ z 



and 



[ Ky Z Ky X ] — [ Yly Z Yly X ] 



(27) 



By noting the relations 

I(U;X\Y) -- 

I(U;Y\Z) = 

I(U;X\Z) -- 

I(U;X\Y) -- 



I(U;X)-I(U;Y), 
I(U;Y)-I(U;Z), 
I(U;X)-I(U;Z), 
I(U;X\Z)-I(U;Y\Z) 
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for random variables satisfying (/ f> I H 7 f> Z, we have 

= I(U;Y\Z)-fiI(U;X\Y) 

= (l + n)I(U;Y\Z)-fiI(U;X\Z) 

= [(l+^)h(Y\Z)-^h(X\Z)] 

+\jih(X\U, Z)-(l + n)h{Y\U, Z)] 
= [(1 + p)h(Y\Z) - »h(X\Z)} - l±t log \Ky X Kl\ 



+fi[h(X\U, Z) - jh(X + K^N 2 \U, Z)] 
[(1 + fi)h(Y\Z) - /j,h(X\Z) 



1 + U , T , 

-^tlog\Ky X K? x \ 



+n[h(X\U, Z) - jh{X + N 3 \U, Z)\ 
\{l + n)h{Y\Z) - nh{X\Z)] - 



1 + M,_„,^ rsT 



— \og\K yx K yx \ 



• logins, 



7 



log(27re) ro |S x |. 



(28) 



where we set 7 := i±£ > 1 and AT 3 := K y ^N 2 . It should be 
noted that 



1*8.1^0 

for \x > 0, which will be proved in Appendix iDl 
For the change of variable 



(29) 



^2; ru r 112 



^(E* .). From Eqs. ([T6J and (EB and the relation 



vre)" 1 
(1 + M) 



^log(2 7 re) m |S :c |„| + \ log(27re) m |E x |„ + SV, 



log(27re) m |E a 



we have 



By the chain rule for the derivative, we have 



0. 



^(E 



•Vi 



Thus, from Eq. (1281 1. we have 

v-l 



( E x| uz ) = 7(E*| UZ + T, N3 y 



(30) 



Step 3: By noting that (X, Y, Z) is degraded, from Corollary 
for any (R p , R k ) £ TZ(X, Y, Z) we have 



Rk — p-Rp 

< I(U;Y\Z)- fj,I(U;X\Y) 

= [(1 + n)h(Y\Z) -fih(X\Z) 



1 + fj. 



— log\Ky X KT x \ 
+ l i[h{X\U,Z)- 1 h{X + N 3 \U,Z)), (31) 



where U is not necessarily Gaussian. By using the conditional 
version of EPI |26], we have 



(32) 



h(X\U,Z) ~ jh(X + N 3 \U, Z) 
< h(X\U,Z) 



7 m 1 1 
— 2~ lo S I ex P 



— h(X\U,Z) 



exp 



-h(N 3 ) 
m 



< f(h(N a )-j]og(<y-iy,h(N a j), 



(33) 



where we set 





' 2 




' 2 




^exp 


—t 


+ exp 


— a 


) 




m 




m 





f(t;o) :=t-^ 

Note that the function f(t;a) is concave function of t and takes 
the maximum at t = a — ^ log(7 — 1) ||2~71 . From Eq. ( f30b . 
we have 



( 7 -l)- 1 E Ar3 =E: 



which implies 



h(N 3 ) — log(7 — 1) 



= -log(27r e ) m ( 7 -l)-" l |E Ar3 | 
= ilog(27r e ) m |E; |uz |. 



Furthermore, since E*, z and Ejv 3 are proportional to each 
other, we have 



\K\u Z \ 1/m + \^N 3 \ 1/m = \K^ + ^\ 1/r 



Thus, from Eqs. OTb and d33l >. we have 

Rk — pRp 



< [(l + n)h{Y\Z)-nh{X\Z)] 



1 + M 



— log \Ky X Kj x \ 



ilog(27re) m |E; |u J - ^ log(27re) m |E*| uz + Eiv 3 



4(^|J-/x4(E: |u ). 



□ 



Remark 6 One of the difficulties in the above proof is that, 
after Step 1, we have to show the extremal inequality of the 
form 

fih(X\U) + h(X + W Z \U) - (1 + n)h(X +W V \U) 



< ^iog|s:,j + - 

(l + M) 



log|E*,„ + E, 



(34) 



This type of extremal inequality has appeared in ll28l Corol- 
lary 2] (scalar version has appeared in 11291 Lemma 1]). In 
lfl4"l . the extremal inequality was proved by using a vector 
generalization of Costa's entropy power inequality [ 30 1 . On 
the otherhand, we showed Eq. (f34-b by using the change of 
variable in Step 2 and by reducing to more tractable form 
(Eq. d32l). which has appeared in the literature [27 1 . By this 
reduction, we only need the standard EPI in our proof instead 
of Costa's type EPI, and our proof seems more elementary. 
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V. Proof of TheoremQ] 

In this section, we show Theorem[T]by using Theorem[2] We 
follow a similar approach as in ifTUl Section 4]. Since the direct 
part can be proved by taking a Gaussian auxiliary random 
variable U in Proposition[3](see Section ITV- At . we concentrate 
on the converse part. Without loss of generality, we can assume 
that the matrices B and E are square (but not necessarily 
invertible). If that is not the case, we can apply singular value 
decomposition (SVD) to show equivalent sources (X' , Y', Z') 
on R m = x R m * x R m - such that K(X', Y', Z') = K(X, Y, Z) 
in a similar manner as ll22l Section 5-B]. 

By using SVD, we can write the matrices as 

B = UyAyVy, 

E = U Z A Z V Z , 

where U y ,V y ,U z and V z are m x x m x orthogonal matrices, 
and A y and A z are diagonal matrices. Let 

B = Uy(Ay+al)Vy, 

E = U v {A z +aI)V z 
for some a > 0. Then, let 

Y = BX + Wy, 

Z = EX + W Z . 
Since B and E are invertible, Theorem [2] implies 

K(X,Y,Z) = Tl G {X,Y,Z). (35) 
In the following, we will show the following lemma. 

Lemma 7 We have 

Tl(X, Y, Z) c TZ(X, Y, Z) + 0(X, Y, Z), 

where 

0(X,Y,Z) = |(0,i? fc ) :0<R k < \ \o%\EY> x E T + /| 
- 1 - log \EH X E T + I\ 

By letting a-^ 0, K G {X, X, Z) converges to Tl G {X, Y, Z) 
and 0(X,Y,Z) converges to {(0,0)}. Thus, Eq. $3$ and 
Lemma [7] imply K(X,Y,Z) C K G (X,Y,Z). 
Proof of Lemma 

Let 

Cy = UyAy(A y + al^Vy, 

C z = U.A^ + aT)-^. 
Then, we have C y Cy ~< I and C z Cj -< /. Thus, we can write 

Y = CyY + Wy, 

z = c z z + w' z 

for W' y - 7V(0, / - CyCl) and W' z - Af(0, 1 - C Z C T Z ), i.e., 
we have 



From Proposition |U for any (R p , Rk) € Tl(X, Y, Z), there 
exist (U, V) satisfying 

Rp > I(U;X)-I(U;Y), 
Rk < I{U;Y\V)-I{U;Z\V), 

and (U, V) o X o (Y, Z). Let 

R p = I(U;X)-I(U;Y), 
R k = I(U;Y\V)-I(U;Z\V). 

Then, we have 

R P -R P > I(U;X)-I(U;Y)-[I(U;X)-I(U;Y)} 
= I(U;Y) - I(U;Y) 
> 0, 

where the second inequality follows from Eq. (l36l l. On the 
other hand, we have 

Rk-Rk < I(U;Y\V)-I(U;Z\V) 

-[I(U;Y\V)-I(U;Z\V)] 
= I(U;Z\V)-I(U;Z\V) 
-[I(U;Y\V) - I(U;Y\V)} 

< I(U;Z\V) - I(U;Z\V) 
= I(U,V;Z)-I(U,V;Z) 

-[I(V;Z)-I(V;Z)} 

< I(U,V;Z) - I(U,V;Z) 
= I(X;Z)-I(X;Z) 

-[I(X; Z\U, V) - I(X; Z\U, V)] 

< I(X;Z)-I(X;Z) 

= ^log\EZ x E T + I\-^log\EZ x E T + I\, 

where the second, third, and forth inequalities follow from the 
Markov relations in Eqs. (f36l > and ( |37| ). □ 

VI. Conclusion 

In this paper, we investigated the secret key agreement from 
vector Gaussian sources by rate limited public communication. 
We characterized the optimal trade-off between the key rate 
and the public communication rate as a (covariance) matrix 
optimization problem. Investigating an efficient method to 
solve the optimization problem is a future research agenda. 

Appendix A 
Derivation of the KKT condition 

We first rewrite the optimization problem in Eq. dT3T > as a 
standard form 



minimize 
subject to 



I p (£ x \ u ) -R° p <0 

"*> ^x\u ^ 



(38) 



X <-> Y o Y, 
X o Z o Z. 



(36) 
(37) 



Let E*| u be an optimal solution for this problem, which is 
also an optimal solution of Eq. dTBl . Then, we have y 
because of the constraint ^(S*^) — R° < 0. Thus, there exists 
a positive definite matrix L satisfying L -< S*i u . 
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Let us consider another optimization problem 



minimize 
subject to 



(39) 



Obviously, £*, is also an optimal solution for the problem in 
Eq. d39l ), and the optimal values for Eqs. ( f38l > and d39l are the 
same. Although the optimization problem in Eq. d39l is not 
convex, there exist Lagrange multipliers Mi y 0, M2 >: 0, 
and /i > satisfying 



(40) 
(41) 
(42) 
(43) 



= M 2 -M 1: 
Mi(E* |u -L) = 0, 
M^-E^J) = 0, 



if the set of constraint qualifications (CQs) shown below are 
satisfied (see 11221 Appendix 4] for the detail). Since £*| M >- L, 
Eq. (|4TT i implies Mj = 0. Thus, by noting the relation 



= ^log(2 7 re) m |S,| l 



■log(27rer|S x | u + E 



+ 



bg(27rer|S ie , tt + E 



+ [(l + f x)h(Y)-h(Z)-nh(X)} ) 



(44) 



and by setting M — 2M2, we have the KKT conditions in 
Eqs. (Q2MH). 

The CQs shown in [22, Appendix 4], which is an interpre- 
tation of [31, CQ5a of Section 5.4] are the following: There 
exists a matrix A satisfying 

1) For any u ^ in the null space of £*, — L, we have 
u T Au > 0. 

2) For any v in the null space of E^ — £*, , we have 
v T Av < 0. 

3) 



Tr 



> 0. 



To check whether the above CQs are satisfied, we suggest 
A given by 

A = a(L - E*,J + (£ a - E*,J 



for a > 0. First we check ([]]). For any u 7^ in the null space 
of E*| M — L, we have 

u T ^u = u T (E x -S: |u )u. 

Suppose that u T (Y^ x — E*| u )u = 0. Then we have 

= u T ((s; |u - L) + (s a - e:,j) u 

= u T (E a -£)u, 

which is a contradiction because E x >- -L. Thus the condition 
((TJ is satisfied. 



Next, we check (0. For any v ^ in the null space of 
E x - E*| u , we have 

v T Av = v T (L-E; |M )v<0 

because L -< E*. . 

Finally, we check (01. By noting 

1 _! 1 _! 

Vs X | U ^(E x | u ) = ~(E x \u + s w y ) ~ 2^ x \ u ^ ^ 
for any E x i u >- 0, we have 



Tr 



= -Tr 
2 



^{(e; |u + e h ,-)- 1 -(e; i j- 1 }(l-e; i j 
{(K\u + s^)' 1 - (s^iJ- 1 } (E, - e:,„ 



Since i — E*| u -< 0, by taking a > to be sufficiently large, 
the condition ([3]) is satisfied. 

Remark 8 We need to introduce the optimization problem 
in Eq. d39l because the arguments in l22l Appendix 4] is 
guaranteed only under the condition such that the range of 
the variable E^i^ is a closed set. 

Appendix B 
Proof of Eqs. ([22]) and ([231) 



By noting M y 0, we have 
Thus we have 



Since E^ a >- 0, by substituting Eq. d2TT i into Eq. ( [Tol l, we 
have 

= T^iK^ + ^K^w.r (45) 

when /1 > 0. Thus, we have 

Note that E^ = E^ -< when (j, = 0. 
From Eq. d45l ). we have 

(E^ + E^r^s^ + E^r 1 , 

where the strict inequality holds for /i > 0. Thus we have 



and especially 



for fi > 0. 



(46) 

□ 
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Appendix C 
Proofs of Eq. 

Eq. d26l ) can be derived by the following sequence of 
equalities: 

= - K\J + (K\u + ^wj] (K\ u + ^wX 1 
= p x -K\«KK\u + ZwX 1 + I 



M 



(£„ - E*, )(E* 

\^x ^x\uJ \ X 



(47) 
(48) 



(E- c -E*| u ) + (E*| u + E Ws ,) (E*|„ + E W J 1 
(E K + E Wy )(E;, (49) 



where Eq. ((47) follows from Eq. (f2Tb and Eq. d48l ) follows 
from Eq. dTTb . 

Appendix D 
Proof of Eq. (|29l) 

From Eqs. d24"l i. ([5]) and d46b . we can write 



Z = X + W y + W', 
where W ~ Af(0, E^ - E W J- Thus, we have 

Eg^ = Eg, 



(50) 



Furthermore, we have 



E 5 -< E 2 



(51) 



From the block inversion of the matrix (e.g. see 
Appendix 5.5]) and Eq. (f27j), we have 



K- — 



Eg S 2 



-S 2 1 E :E >5' 1 
5- 1 



= (7 - EgEj^E^- 



(52) 



where 



S = E 3 



Ej.E_ E. T 



is the Schur complement. 
From Eq. ( Bil l, we have 



I - Ef EJ x Ef >- I - Ef Eg X S| = 
Thus we have 

iJ-EgE^lJ-EfE^Efl^O. 
By combining Eqs. d52l and d53l >. we have Eq. 



(53) 
□ 
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